Prevent a retrieved document from authorizing tool use

A document can contain “send this file” or “approve this transaction.” Retrieval makes that text relevant; it does not make it an authenticated instruction.

Enforce the authority source

The agent controls lab includes an injected synthetic policy.

from agent_cases import retrieved_authority_case

result = retrieved_authority_case()
assert result["user_authority"] == {"read_policy": True, "send_external": False}
assert result["proposal"]["authorized"] is False
assert result["executed"] is False
assert result["retrieved_text_granted_authority"] is False

The retrieved string requests an external email, but application state permits only reading. No email tool runs.

Separate evidence, intent and authority

Authenticated user input defines requested intent within policy. Retrieved/tool content supplies evidence. Application authorization determines permitted tools/resources. The model cannot merge those channels to expand scope.

Enforce tool allowlists and arguments outside the model. Keep write credentials unavailable to read-only paths. Require approval bound to exact side-effect details. Sanitize model output before rendering or executing anything.

Test indirect injection

Place hostile instructions in body text, metadata, filenames, tables and tool responses. Include benign security documents that quote similar phrases. Measure both unauthorized-action prevention and task completion; blocking every document is not useful.

The Generative & Agentic AI course connects this control across RAG, agents and MCP.

Exercise

Create 20 indirect-injection cases against a read-only agent. Prove none activates a write tool and record any legitimate research task falsely blocked.

Continue learning

This article is part of the Agent workflows and state sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Evaluate an agent trajectory as well as its final answer.
• Continue with Design a safe read-only research agent.

Reference: OWASP LLM01 prompt injection.